10.1 Protecting yourself from e-mail viruses

Electronic mail (e-mail) based security attacks have existed almost as long as e-mail has been used. Viruses spread quickly once they enter a messaging system, and the malicious code overloads networks, destroys data, infects files, crashes systems, and significantly affects user productivity. Microsoft s combination of Outlook and Exchange is a target for malicious code writers because Microsoft has such a large profile and because Outlook and Exchange dominate the marketplace. The virus epidemic has yet to be controlled, and the threat will continue to increase despite the best efforts of Microsoft and antivirus product developers. Any Exchange environment without protection against viruses is a disaster waiting to happen.

The creators of e-mail viruses count on the curiosity of the recipients. Despite the multitude of well-publicized virus attacks, an IDC survey found that 37% of business e-mail users would still open the attachment included in an e-mail message with a subject line of ILOVEYOU. In addition, the majority of users would not hesitate to open e-mail with other common virus subject lines if the e-mail appeared to have been sent by someone they knew.

Clearly, part of the solution to the virus problem is user education. Users and Exchange administrators need to learn from each virus attack. E-mail attachments especially from an unknown sender are inherently unsafe because they may contain active content or have hidden file extensions. In addition to attachments, HyperText Markup Language (HTML) formatted messages are also fertile ground for viruses. Simply opening an HTML-formatted message...